What am I missing for my SSRS Service account local server permissions?

Question

I have a relatively new instance on SSRS 2008R2 SP3 running on Windows Server 2008 R2. I am trying to set up separate domain service accounts for the separate SQL Services i.e. agent, engine, reporting, etc. I have done this successfully for the Agent and Engine services using simple Domain accounts and following the required permissions from learn.microsoft.com.

At first I had made local accounts for all services because of a video I watched that used that as an example. So now that I actually wanted to start using reporting services I switch the account to a newly created Domain account. Using the pertinent section in the above article I configured, via GPO, the account to have "Log On As A Service" right. I ensured that right is present in the groups I created.

I then went into the Reporting Services Configuration Manager to change the account which was successful except that the step for starting the service ended in error.

System.InvalidOperationException: Cannot start service ReportServer on computer 'SQLSERVER01'. ---> System.ComponentModel.Win32Exception: Access is denied
   --- End of inner exception stack trace ---
   at System.ServiceProcess.ServiceController.Start(String[] args)
   at System.ServiceProcess.ServiceController.Start()
   at ReportServicesConfigUI.Panels.ServerInformationPanel.StartStopServiceTask(Boolean start)

Event Viewer has a similar error which I include to save the questions.

The SQL Server Reporting Services (MSSQLSERVER) service failed to start due to the following error: 
Access is denied.

So this is a Windows permission issue but I don't see what the problem could be since the Log On As a Service permissions are set correctly. That is verified by the security logs that show a successful logon of the account. If I make my service account a local admin on the server then the service starts correctly but I should not have to do that.

Answer 1

As part of the troubleshooting I was doing to try and address the issue I ran Process Monitor while I was trying to start the service.

I tracked as event that also had a result of "Access Denied" which was the service trying to read files inside the directory where reporting services was installed an running from. In my case it was: "C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services"

I check the security of the folder and the service account I was using had no rights to the folder. That is why giving it local admin rights fixed it because that group did have access.

I gave my service account Modify access to the folder and its contents. After that I was able to start the service.

Answer 2

The easier way to do it is to change the service account of the SQL Server Reporting Services service via the SQL Server Reporting Services Configuration Manager (SSRSCM).

When you change the service accounts using SSRSCM the permissions for the required directories, modules, etc. are all set correctly.

During the process you may be asked to secure the encryption key and to provide a Administrator account to modify certain settings.

1. Open SSRSCM

2. Switch Service Account / Hit Apply

3. Backup Encryption Key

4. Specify an Administrator Account

If you aren't already using a fully privileged Administrator account to modify the SQL Server Reporting Services settings, then here is the last chance to modify the account that will perform the modifications (not the account you wish to switch to). Then/Otherwise hit OK.

5. Result

The output displayed in step 2. is what happens is everything is successful.

Hint

1. Manually editing services in the services.msc plug-in can lead to errors.
2. You can use the above steps to fix a broken SSRS service account. Just switch back to ReportServer account and then back to the account you wish to switch to.